> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nylon.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Roles and permissions

> What Owner, Admin and Member can each do in a Nylon organization.

Every member of an organization has one of three roles. They differ only in **who can manage the team** — none of them restricts what you can do with connections, keys, webhooks or the API.

| Role       | What it can do                                |
| ---------- | --------------------------------------------- |
| **Owner**  | Full access, including managing other owners. |
| **Admin**  | Can manage members and team settings.         |
| **Member** | Can use Nylon, but cannot manage members.     |

## What that means in practice

<AccordionGroup>
  <Accordion title="Owner" icon="crown">
    Everything an Admin can do, plus the ability to act on other Owners. Owner is not assignable from the Team panel — the role dropdown offers Admin and Member only — so an organization's owners are set when it is created rather than handed around casually.
  </Accordion>

  <Accordion title="Admin" icon="user-cog">
    Can invite, remove and change the role of Members and other Admins, but cannot touch an Owner. This is the right role for whoever runs the team day to day.
  </Accordion>

  <Accordion title="Member" icon="user">
    Full use of the product — connect accounts, create API keys, add webhooks, read logs — with the Team panel read-only. This is the right default for engineers.
  </Accordion>
</AccordionGroup>

## What no role restricts

There is no read-only role, and no role that can use the API but not connect accounts. Anyone in the organization can:

* Connect and disconnect social accounts
* Create and revoke API keys
* Add, edit and delete webhook endpoints, and rotate their signing secrets
* Read request logs for their own keys
* Publish test posts to any connected account

<Warning>
  Any member can create an API key that publishes to every connected account in the organization. If you need separation between teams or between clients, use separate organizations rather than roles.
</Warning>

## Leaving

You can remove yourself from an organization from the same row, as long as you are not an Owner. An Owner cannot leave.

## Related

<Columns cols={2}>
  <Card title="Invite your team" icon="users" href="/help/invite-your-team">
    Sending, resending and cancelling invitations.
  </Card>

  <Card title="Keep keys secure" icon="key" href="/help/keep-keys-secure">
    What to revoke when someone leaves.
  </Card>
</Columns>